🚨 Filebeat Error: 'Filebeat is unable to load the ingest pipelines' — Cause, Fix, and Troubleshooting Guide

What this error means

During filebeat setup or at startup, Filebeat installs the ingest pipelines its enabled modules require. When that installation fails, it reports:

Exiting: Failed to start crawler: Filebeat is unable to load the ingest pipelines for the configured modules because the Elasticsearch output is not configured/enabled. If you have already loaded the ingest pipelines or are using Logstash pipelines, you can ignore this warning.

There are two common shapes. The first, above, appears when modules are enabled but the output is Logstash (or otherwise not a reachable Elasticsearch), so Filebeat cannot reach ES to install pipelines. The second is a privilege or connectivity failure while putting the pipeline. Either way, the module pipelines are not installed, so module data would be rejected downstream with pipeline ... does not exist.

Where records stall

• Filebeat is unable to load the ingest pipelines for the configured modules at startup.
• Message notes the Elasticsearch output is not configured/enabled.
• Occurs when using a logstash output together with enabled modules.
• Or a privilege error (unauthorized) while installing the pipeline.

Following a record through the pipeline

Confirm which output is active and whether modules are enabled:

grep -A3 'output\.\(elasticsearch\|logstash\)' /etc/filebeat/filebeat.yml
filebeat modules list

Verify the setup user can manage pipelines against the cluster:

curl -sk 'https://es01:9200/_security/user/_privileges' -u elastic:$ES_PASS
curl -sk 'https://es01:9200/_nodes/ingest?filter_path=nodes.*.roles' -u elastic:$ES_PASS

Pipeline causes

• Logstash output + modules — Filebeat cannot install pipelines without a direct ES output.
• ES output disabled/unreachable during setup.
• Insufficient privileges — the setup user lacks manage_pipeline / ingest admin rights.
• No ingest node available in the cluster.
• Skipped setup — pipelines were expected but never loaded.

Remediation

When shipping via Logstash but using Filebeat modules, load the pipelines out-of-band by pointing setup at Elasticsearch directly, then let Logstash reference them:

filebeat setup --pipelines --modules nginx \
  -E 'output.logstash.enabled=false' \
  -E 'output.elasticsearch.hosts=["https://es01:9200"]' \
  -E 'output.elasticsearch.username=elastic' \
  -E 'output.elasticsearch.password=${ES_PASS}'

In the Logstash elasticsearch output, reference the module pipeline so events flow through it:

output {
  elasticsearch {
    hosts => ["https://es01:9200"]
    pipeline => "%{[@metadata][pipeline]}"   # set by Filebeat module metadata
  }
}

If the failure is privileges, grant the setup user manage_pipeline (cluster privilege) and re-run setup. Restart Filebeat once pipelines are present.

Keeping ingestion stable

• With a Logstash output this message can be benign if you already loaded pipelines — but module data needs them somewhere.
• Use a privileged admin user for --pipelines, not the least-privilege shipping user.
• Pipeline names are version-stamped; reload them after a Filebeat upgrade.
• Ensure at least one node has the ingest role.

Related pipeline errors

• Filebeat Error: ‘pipeline with id does not exist’
• Filebeat Error: ‘Failed to start crawler’
• Filebeat Error Guide: ‘could not load index template’